EXISTENCE AND OPTIMALITY OF w-NON- ADJACENT FORMS 
WITH AN ALGEBRAIC INTEGER BASE 
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Abstract. We consider digital expansions in lattices with endomorphisms acting as base. We 
focus on the ui-non-adjacent form (uj-NAF), where each block of w consecutive digits contains at 
most one non-zero digit. We prove that for sufficiently large w and an expanding endomorphism, 
there is a suitable digit set such that each lattice element has an expansion as a ui-NAF. 

If the eigenvalues of the endomorphism are large enough and w is sufficiently large, then 
the io-NAF is shown to minimise the weight among all possible expansions of the same lattice 
element using the same digit system. 



1. Introduction 

One main operation in hyperelliptic curve cryptography is the computation of multiples of 
a point on a hyperelliptic curve over a finite field. Clearly, we want to perform that scalar 
multiplication as efficiently as possible. A standard method are double-and-add algorithms. But 
if the hyperelliptic curve is defined over a field with q elements and we are working in the point 
group over an extension (i.e., working over a field with q m elements), then we can use a Frobenius- 
and-add method instead. There the (expensive) doublings are replaced by the (cheap) evaluations 
of the g-Frobenius endomorphism in the point group. 

In the endomorphism ring of the point group, the Frobenius endomorphism (p acting on the 
group has a characteristic polynomial / e Z[X]. Let r be a complex zero of /. If we write a 
z <= Z[t] as z = Y^j=o r l3 T ^ f° r some Vj ou t of a digit set T>, then we can calculate zP for a 
point P on the curve by evaluating X^=o VjV^iP)- Note that when 2 is a rational integer, we are 
calculating multiples of the point P as mentioned at the beginning of this section. Therefore we 
have to understand numeral systems with an algebraic integer r as base. 

The sums in the previous paragraph are usually evaluated by a Horner scheme. There the 
number of additions when calculating zP corresponds to the number of non-zero digits (Hamming 
weight) of our expansion of z. Therefore we are interested in expansions of small weight. Let w be 
a positive integer. An expansion which gives a low Hamming weight is the w-non-adjacent form, 
D-w-NAF for short, cf. [TTl [Tl [T3]. It is defined by the syntactic requirement that every block of 
w consecutive digits contains at most one non-zero digit. Suitable conditions on T> are required 
such that it is a w- non-adjacent digit set (w-NADS for short), which means that each element of 
Z[t] has a representation as a D-u>-NAF. 

In the present paper we give positive results on that existence question. Our set-up is more 
general: In Section^ which contains the definitions and some basic results, we work in an Abelian 
group and the base is represented by an injective endomorphism on that group. In the remaining 
article, starting with Section [31 the set-up is a lattice A in M" and an injective endomorphism on 
A as base. The case of algebraic integer bases is a special case of this set-up, cf. Examples 12.21 
andO 
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In Section [3] we prove a necessary condition to be a w-NADS, namely that the endomorphism 
has to be expanding. Section @] deals with the setting when the digit set comes from a tiling of 
R n . Theorem [Al states that we have a w-NADS if w is sufficiently large. The bound in that result 
is explicit. Another result of that kind is given in Section [SJ generalising a result of German and 
Kovacs [7] to 23-w-NAFs. There minimal norm digit sets are studied. Again we get a w-NADS if 
w is larger than a constant, which depends (only) on the eigenvalues of cf. Theorem [Bj As an 
important example, we discuss the setting of bases r coming from hyperelliptic curves, see above, 
in Example 15.21 

The last section is devoted to the question of minimality: Are the 23-w-NAF-expansions optimal, 
i.e., does the 23-w-NAF-expansion of an element minimise the weight among all possible expansions 
of that element with the same digit set? We provide a positive answer for sufficiently large w and 
sufficiently large eigenvalues of $ in Theorem [Cj 

2. w-Non-Adjacent Forms and Digit Sets 

In this section, we formally introduce the notion of w-non-adjacent forms and w-non-adjacent 
digits sets. 

We consider an Abelian group A, an injective endomorphism $ of A and an integer w > 1. 
Let 23* be a system of representatives of those residue classes of A modulo <$> w (A) which are not 
contained in $(A). We set 23 = V U {0}. 

We call the triple (.A, $,23) a pre-w -non- adjacent digit set (pre-w-NADS). 

Definition 2.1. (1) A word r] = r\g,-\ ...rjo over the alphabet 23 is said to be a V-w-non- 
adjacent form (T>-w-NAF), if every factor r)j-\. w -i < j < I — w, contains at most 

one non-zero letter r/k- Its value is defined to be 

l-l 

value(?7£_i . . .rj ) =^$- 7 (%). 

3=0 

We say that rj is a V-w-NAF of a £ A if valued) = a. 
(2) We say that T> is a w -non- adjacent digit set (w-NADS), if every a € A admits a 2?-u>-NAF. 

Example 2.2. Let K be a number field of degree n, O be an order in K and r £ O. We consider 
the endomorphism $ T : D — > O with a <— > rot, i.e., multiplication by r. Then let T> m be a system 
of representatives of those residue classes of O modulo r w which are not divisible by r and 
V = V U {0}. Then (D, $ T ,2?) is a pre-w-NADS. Note that 

e-i 

value(%_i . . . rjo) = 2J Vjt 3 

3=0 

for a word . . . rjo over the alphabet T>. 

We state a few special cases. 
Example 2.3. Let r G Z, |r| > 2 and w > 1 be an integer. Consider 

f kr kl™ 

23* = jdeZ: < d< ^-,rfd 

and X> = 2?" U {0}. Then (Z, "JVjP) is a pre-w-NADS, where $ r still denotes multiplication by t. 
It can be shown that (Z, ■J't-jP) is a w-NADS. This will also be a consequence of Theorem IBl 

Example 2.4. Let r be an imaginary quadratic integer and T>* a system of representatives of those 
residue classes of Zk] modulo t w which are not divisible by r with the property that 

if a ee (mod t w ) and a G 23*, then |a| < |/3| 

holds for a, P £ Z[r] which are not divisible by r. This means that 23 contains a representative of 
minimal absolute value of each residue class not divisible by r. As always, we set 23 = 23 # U {0}. 

Then, for w > 2, (Zk],$ T ,23) is a w-NADS (cf. Heuberger and Krenn [8J), where $ T still 
denotes multiplication by r. 
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For r e {(±1 ± yf^f) /2, (±3 ± 7^3) /2, 1 + V^, V^, (1 + /2}, this has been shown by 

Solinas PHE3 and Blake, Murty and Xu HE], cf. also Blake, Murty and Xu [3J for other digit 
sets to the bases (±1 ± y/—7)/2. 

At several occurrences, it is useful to consider equivalent pre-w-NADS. 

Definition 2.5. The pre-w-NADS (.4, $,2?) and (A' , <f>' ,T>') are said to be equivalent, if there is 
a group isomorphism Q : A — > A 1 such that the diagram 




A 1 >A' 

$' 

commutes and such that V = Q(D). 

It is then clear that the following proposition holds. 

Proposition 2.6. Let (A,$,V) and (A',<&',V) two equivalent pre-w-NADS. Then V is a w- 
NADS if and only ifV is a w-NADS. 

Proof. Straightforward. □ 

Example 2.7. We continue Example 12.21 i.e., K is & number field, D an order in K, r G D, the 
endomorphism considered is <f> T , the multiplication by r, and the digit set V is as in Example 12.21 
The real embeddings of K are denoted by u\ , . . . , a s ; the non-real complex embeddings of K 
are denoted by er s +i, ctJ+I, ■ ■ ■ , c s +tj Cs+t, where ~ denotes complex conjugation and n = s + 2t. 
The Minkowski map £ : K — > M™ maps a € K to 

(ffi(a), . . . ,a s (a),1Ra s+ i(a),Qa s+1 (a), . . . , 3?cr s+t (a), 3er s+t (a)) e R™. 

We write A = S(D) for the image of O under S. Note that A is a lattice in R ra . We consider the 
n x n block diagonal matrix 

5Rcr s+ i(r) -3cr s+ i(r)\ /SRo-g +t (r) -3cr s+f (r)\ \ 
3a s+1 (r) 3?a s+1 (r) J ' * " * ' ^a s+t (r) 3?a s+t (r) ^ ^ 

and set £>' := £(£>). Then the pre-w-NADS (D,$ r ,X>) and (A, are easily seen to be 

equivalent, where $>' T (x) :— A T ■ x for x £ M. n . 

Note that if K is an imaginary quadratic number field (cf. Example 12. 4p , this construction 
merely corresponds to a straight-forward identification of C with M 2 . 

In order to investigate the iu-NADS property further, it is convenient to consider the following 
two maps. 

Definition 2.8. Let (A, $,£>) be a pre-w-NADS. We define 

(1) d: A -> V with d(a) = for a £ $(A) and d(a) = a (mod $ W (A)) for all other a € A, 

(2) T: A -> A with a i-> ^(a - d(a)). 

Note that the map d is well-defined as D" contains exactly one representative of every residue 
class of A modulo $> W (A) which is not contained in $(A). Furthermore, we have a = d(a) 
(mod $(-4)) for all a € A. Therefore and by the injectivity of the map T is well-defined. We 
remark that by definition, we have T(0) = 0. 

We get the following characterisation, which corresponds to the backwards division algorithm 
for computing digital expansions from right (least significant digit) to left (most significant digit). 

Lemma 2.9. Let a G A. Then a has a D-w-NAF r/g-i . . . t/q if and only if T £ (a) = 0. In this 
case, we have r)k = d(T k (a)) for < k < I. In particular, the D-w-NAF of an a E A, if it exists, 
is unique up to leading zeros. 



A r := diag oi(t), . . . ,ct s (t), 
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Proof. Assume that ?y^_i ... 770 is a T>-w-NAF of a. We clearly have a = r/o (mod $(A)), so that a 
is an element of $(A) if and only if tjq = 0. Otherwise, the w-NAF-condition ensures that a = r/o 
(mod $ U '(A)). In both cases, we get d(a) — r/o and therefore 

T(a) = value(?7£_i . . .771). 

Iterating this process yields T k (a) = value(r^_i . . .rjk) for < k < £, where rji^i .. .r\% is a 
O-io-NAF. For k = I, we see that T i (a) is the value of the empty word, which is zero by the 
definition of the empty sum. 

Conversely, we assume that T e (a) = 0. We note that if d(f3) ^ for some (3 £ A, we have f3 — 
d{p) = (mod $™(A)), which results in T 3 (f3) = ®-i{P-d(fi)) = (mod $(A)) and d(T^(j8)) = 
for 1 < j < w - 1. Therefore, the word rj = d(T l - 1 (a)) . . . d{T{a))d(a) is a 25-w-NAF. Iterating 
the relation /3 = $(T(/3)) + d(/3) valid for all /3 e A, we conclude that a = $ e (T e (a)) + valuefa) = 
value(r;). □ 

3. Lattices and P-w-NAFs 

We now specialise our investigations to the case that the abstract Abelian group A is replaced 
by a lattice in R ra , i.e., A = A = wiZ © • • • © u>„Z for linearly independent wi, . . . , i« n € K™. 
Further let $ be an injective endomorphism of W 1 with $(A) C A, w > 1 be an integer, and 2?* a 
system of representatives of those residue classes of A modulo $ u ' (A) which are not contained in 
$(A), and set V = V U {0}. 

The results are still applicable to the case of multiplication by r in the order of a number 
field, as the purpose of Example 12.71 was to describe it as equivalent to a lattice A C M n via the 
isomorphism E. 

The aim of this section is to prove a necessary criterion for a pre-w-NADS to be a ui-NADS. 

Proposition 3.1. Let T> be a w-NADS. Then $ is expanding, i.e., |A| > 1 holds for all eigenval- 
ues A of $. 

Proof. (1) We first consider the case that there is an eigenvalue A of $ with |A| < 1. 

In a somewhat different wording, this has been led to a contradiction by Vince |14| . 
The idea is the following: After a suitable change of variables, the endomorphism $ can 
be represented by a Jordan matrix such that the first k coordinates, say, correspond to 
the eigenvalue A. Thus the first k coefficients of valued) are bounded independently of 
the word r\ over the alphabet T>. Thus it is impossible to have a representation of all 
elements of A. This is completely independent of the w-NAF-condition (and gives, in fact, 
a stronger result, as representability by any word over the digit set is impossible). 
(2) We next consider the case that |A| > 1 for all eigenvalues A of $ with equality |Ao| = 1 for 
at least one eigenvalue Ao- 

We again follow Vince [TJ], see also Kovacs and Petho [TU], to see that Ao must be a 
root of unity. The idea is that Ao is a unit in Z[Ao, Ao], as Ao is its inverse. Therefore, A 
has absolute norm ±1. As we already assumed that all its absolute conjugates are at least 
1 in absolute value, this implies that all absolute conjugates of Ao lie on the unit circle. 
Thus Ao is a root of unity. 

As a consequence, there is some £ such that X e = 1. In other words, 1 is an eigenvalue 
of $ . After a suitable change of coordinates, A can be assumed to be Z™ and $ can 
be represented by a matrix with integer entries. Let a be an eigenvector of $^ with 
eigenvalue 1. Multiplying a by a suitable integer if necessary, we can assume that a G 
Z" = A. As a — $ (a), we get a e $ fe (A) for all integers k > 0, which implies that 
d(T k (a)) — holds for all k. Furthermore, we cannot have T k {a) — for any k > 0. 
Thus, a cannot be represented. □ 

4. Tiling Based Digit Sets 

In this section, we consider a fixed lattice A C R™ and an expanding endomorphism $ of R" 
with $(A) C A. We will discuss digit sets constructed from tilings. 
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Definition 4.1. Let V be a subset of R n . We say that V tiles R" by the lattice A, if the following 
two properties hold: 

(1) U 6 A(* + ^)=K n , 

(2) Vn(z + V)CdV holds for all z G A with z ^ 0. 
We now assume that V be a subset of R ra tiling R ra by A. 

Lemma 4.2. Le£ w > 1 and 

P:={aeA: $-™(a) € V}. 
TTien I? contains a complete residue system of A modulo $ U '(A). 

Furthermore, if a, a' e T> with a ^ a' and a = ol (mod $™(A)), fften $ _u, (a), $~™(a') G <9F. 

Proof. Let /3 G A. Then there is a 7 G A and & v e V such that $ _lu (^) = 7 + u. Setting 
q := f3 — $"'(7), this implies that 

$- w (a) = <5>-' w (j3) - 7 = v G V, 

i.e., a G T> and (3 = a (mod $ tu (A)). 

Assume now a, a' € I? with a/a' and a = a' (mod $ tu (A)). We write a' = a + $^(7) for a 
suitable 7 G A. We obtain 

$-«-(a') = $-' u (a) +7, 

which implies that $~ w (a') G 5 V. Analogously, we get Q>~ w (a) G 9V. □ 

For an integer it) > 1, we choose a subset T>* of I? in such a way that I?* contains exactly one 
representative of every residue class modulo <& w (h) which is not contained in $(A). We also set 
V:=VU{0}. 

Theorem A. Let \\ ■ \\ be a vector norm on R n such that for the corresponding induced operator 
norm, also denoted by \\ ■ \\, the inequality H^ -1 !! < 1 holds. Let r and R be positive reals with 

{x G R" : ||x|| <r}C7C{iel": ||x|| < R}. (1) 

If w is a positive integer such that 

»*"'»"< ttW' (2) 

then V is a w-NADS. 

Remark 4.3. In the case of expansions in an order of a number field (Example 12. 7|l . we may 
take || • || to be the Euclidean norm || ■ 1 1 2 , as the corresponding operator norm fulfils HA" 1 ^ = 
max{ 1/ 1 cTj(r) I : 1 < j < s + t}. In this case, © is equivalent to |oj(t)| u ' > 1 + R/r for all 
1 < 3 < 8 + t. 

Proof of Theorem\^ Let a G A. We claim that 

\\T k {a)\\< — ^- I ^ + ||$-if.||al| (3) 

holds for all k with the property that d(T k (a)) = holds for all non- negative k' with k — w < 
k' <k. 

For k = 0, J3]) is obviously true. We assume that ([3]) holds for some k. As an abbreviation, we 
write j3 — T k (a) and 77 = d(j3). If rj = 0, then we have 

iiT fe +v)n = \\t(p)\\ = wz-'m < w^-'w ■ < fq^F + ||$ ~ 1||fc+1 ' H a "' 

which proves ^ for k + 1. 
In the case 77 7^ 0, we get 

||r fc +-(a)ll = \\$- w W -v)\\< W^T ■ WPW + \\^ W M\\ 

- H^ 1 !! 10 ( — pNf + ' Nl ) + R = + l ^ k+w ■ l|a|1 ' 
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which is ([3]) for k + w. 

By ||3J| and ©, we can choose a ko such that 

\\<£- w (T k (a))\\ < ^^L^R+\\$-if +w ■ \\a\\ < r (4) 

holds for all k > ko- 

If T k °(a) = 0, then a admits a D-ukNAF by Lemma |2~51 Otherwise, choose k > ko maximally 
such that T ko (a) £ $ fe - fe °(A). This is possible because <& is expanding. This results in T k (a) (fc 
<1>(A). Then (gj) implies that 

\\$- w (T k (a))\\ < r. 

By H|, we conclude that <&- w (T k (a)) is an element of the interior of V. 

By Lemma IO we obtain <Z>- w (T k (a)) € V, hence d{T k {a)) = T k {a) and T k+1 (a) = 0. Thus 
a admits a V-w-NAF by Lemma [2751 □ 



5. Minimal Norm Digit Set 

In this section, we study a special digit set, the minimal norm digit set. In the case of an 
imaginary quadratic integer r, this notion coincides with the minimal norm representative digit 
sets introduced by Solinas [TH US] ■ 

Let again A be a lattice in 1" and $ an expansive endomorphism of K™ with $(A) C A. Choose 
a positive integer wo such that |A| > 2 X / Wa holds for all eigenvalues A of $. Thus the spectral radius 
of is less than l/2 1 / w °. We choose a vector norm || • || on R" such that the induced operator 
norm (also denoted by || • ||) fulfils H^ll < l/2 1 / w °. As a consequence, we have ||$ 1 \\ w < 1/2 
for all w > wo- 

Again, in the case of expansions in an order of a number field (Example 12 .7p . we may take || • | 
to be the Euclidean norm || • 1 1 2 , cf . Remark 14.31 

Let V be the Voronoi cell of the origin with respect to the point set A and the vector norm 
II -II, i-e., 

V = {z e K" : \\z\\ < \\z + a\\ holds for all a e A}. 

While V does not necessarily tile M" by A (consider the norm || • and the lattice generated 
by (1, 0) and (0, 10) in R 2 ), for a given integer w > 1, we can still select a set V of representatives 
of those residue classes of A modulo $ tu (A) which are not contained in $ U '(A) such that 

V C {a e A : $-™(a) E V}. 

As usual, we also set T> := V U {0} and call it a minimal norm digit set modulo $> w . 

Adapting ideas of German and Kovacs [7] to our setting, we prove the following theorem. 

Theorem B. If w > wo, then T> is a w-NADS. 

Proof. We set M := max{||7y|| : rj € T>}. For /3 € A, we have 

\\Tm = \\*- l tf-dm\\<\\*-^(w\+M)' 

Setting 
we see that 

\\T(I3) || < ||/3|| if ||/3|| >Af, 
\\T(p)\\<M if ||/3|| <M. 

As A is a discrete subset of R™, we conclude that the sequence (T k (a))k>o is eventually periodic 
for all a € A. 

For /3 e $(A) with /3 ^ 0, we have 

ITOJi^H^GS)!!^!^- 1 !!- 11/811 <ll)8||. 
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Consider the set 

P := {P e A : p £ $(A) and (T k ((3)) k > is purely periodic}. 

The set P is empty if and only if for each a £ A, there is an t with T l {a) = 0, i.e., a admits a 
25-w-NAF. Therefore, by Lemma 12121 P is empty if and only if I? is a w-NADS. 

We therefore assume that P is nonempty. We choose anagP such that ||$~™(a)|| > ||$ _u, (/3)|| 
holds for all /3 g P. This is possible, since all elements /3 of P fulfil ||/3|| < M, which implies that 
P is a finite set. 

Next, we choose t > with T £ (a) = a and set n k = d(T k {a)) for < k < I. We set 

N := {0 < fc < £ : % ^ 0}. 

By the iu-NAF-condition, we have |fc — k'\ > w for distinct elements fc and fc' of N. 
By definition of T, we have 

£-1 £-1 

a = T e (a) = $- e (a - £ $ fc (r/ fc )) = - £ ^fe). 

Applying <£> -,! " once more and rearranging yields 

i-x 

= (id-$^)- x (- ^ $ fe ^ (5) 

fc=0 

Note that we restricted the sum to those k corresponding to non-zero digits. 
We claim that 

\\<i>- w (Vk)\\ < \\®- w (T k (a))\\ < \\3>- w (a)\\ (6) 

holds for k 6 N. The first inequality is an immediate consequence of the definition of V, as 
$-«>(T fe (a)) = ^~ w (rj k ) + 7 for a suitable 7 € A. Here, we used that r]k ^ implies that 
T fe (a) £ $(A). Therefore and as T k+e (a) = T k (T e (a)) = T k (a), we also get T k {a) e P. By the 
choice of a, we conclude the second inequality in (J6]). 
Taking norms in (0) yields 

ii*-»ii < l^2 a) i E 11^- "ir fc - (7) 



As £ € AT, we have 



* i 1 _ 1 1 <f> - 1 1 1 mw 

E < II*" 1 !!™ + \^~ l t w + ■■■ + ll^ 1 !!"™ = 1 , («) 



fc=0 

where to = [£/w\. Combining ([7]) and ((5]) yields 

1 -ii$- 1 ih i-ii$ 



as ||$" 1 |r < 1/2, contradiction. □ 
We restate this result explicitly for expansion in orders of algebraic number fields. 

Corollary 5.1. Let K be an algebraic number field of degree n, <j\, . . . , o~ s the real embeddings 
and cr s +i; c s+ i, . . ., cr s +t, a s +t be the non-real complex embeddings of K . 

Let O be an order of K and r G D such that \o-j(r)\ > 1 holds for all j. Let w be an integer 
with 

log 2 
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Let T>* be a system of representatives of those residue classes of O modulo t w which are not 
divisible by r such that 

s+t ^ 2 s+t ^ ^ 

if a = f3 (mod t w ) with r \ a and a € T>, then dj |<7j (~) — °J |°J ( — w 

where dj = 1 /or j G {1, . . . , s} and aj = 2 /or j G {s + 1, . . . , s + £}. Then T> := I?* U {0} is a 
w-NADS. 

Example 5.2. Let C be an algebraic curve of genus g defined over ¥ q (a field with q elements). 
The Frobenius endomorphism operates on the Jacobian variety of C and satisfies a characteristic 
polynomial P G Z[T] of degree 2g. Let t be a root of P. Set K = Q[r] and D = Z[r], and 
denote the embeddings of if by cry. Using Corollary 15. H a minimal norm digit set modulo t w is 
a u;-NADS if 

log 4 

w > . 

logq 

This is true because of the following reasons: The polynomial P fulfils the equation 

P(T) = T 29 L(1/T), 

where L(T) denotes the numerator of the zeta- function of C over ¥ q , cf. Weil |151 IT?] . The 
Riemann Hypothesis of the Weil Conjectures, cf. Weil [TB], Dwork [5] and Deligne [S], state that 
all zeros of L have absolute value 1/y/q. Therefore |<Jj(r)| = ^/q, which was to show. 

6. Optimality of X>-u;-NAFs 

In this section, we consider a lattice A C 1" and an expanding endomorphism $ of R™ with 
*(A) C A. 

Definition 6.1. Let rj — nt-i ... 770 be a word over the alphabet V. Its (Hamming-)weight is the 
cardinality of {j : r\j 7^ 0}, i.e., the number of non-zero digits in 77. 

Let z = value(?7). The expansion 77 is said to be optimal if it minimises the weight among all 
possible expansions of z, i.e., if the weight of rj is at most the weight of £ for all words £ over V 
with value(^) = z. 

We will show an optimality result for 2?-w-NAFs in Theorem [Cl where the digit set comes from 
a tiling as in Section 0] 

Lemma 6.2. We have 

lim $ m (A) := Pi $ m (A) = {0}. 

m£N 

Proof. Let a G lim^oo $ m (A) = f| me N $ m ( A )- Tnen tnere is a sequence (/3 m ) mSNo , all f3 m G A 
and with f3 m = Q~ m (a). As $ is expanding, we obtain (3 m ->0asm tends to infinity. The lattice 
A is discrete, so f3 m = for sufficiently large m. We conclude that a — 0. □ 

Now we define the digit set: We start with a subset V of K™ tiling M" by A. For a positive 
integer w let 

V := {a G A : <f>- w {a) G V} 

and 

V int := {a G A : $" w (a) G int V}, 

where int V denotes the interior of V. We choose a subset T>* of T> in such a way that T>* contains 
exactly one representative of every residue class modulo "J?™ (A) which is not contained in ^(A). 
We also set T> := T>* U {0}. This is the same construction as in Section 0] 

Lemma 6.3. Assume that V C $(V). Then each element of T> mt \ {0} has an expansion of 
weight 1. 
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Proof. Let a € T>i nt \ {0}, and let /3 = <5 6 A such that the non- negative integer £ is 

maximal. Therefore (3 ^ $(A). We have that <3> _t "(/3) = ^""^(a) is in the interior of $~ e (V). 
Using V C $(U) yields $" u '(^) e intU, and therefore, by Lemma 0T1 P G T>*. Thus a = 
has an expansion of weight 1 . □ 

Theorem C. Assume that V C &(V), V = —V and that there are a vector norm || • || on M™ 
and positive reals r and R such that 

{x e K n : ||x|| < r} C V C {x £ K" : ||a;|| < i?} (9) 

and such that the induced operator norm (also denoted by \\ ■ \\) fulfils H^ -1 !! < i. 
If w is a positive integer such that 

ii^ 1 ir<^(^-n^ 1 n) (io) 

and T> is a w-NADS, then the V-w-NAF- expansion of each element of A is optimal. 

The proof relies on the following optimality result. 
Theorem (Heuberger and Krenn [3]). // 

lim $ m (A) = {0}, (11) 

and if there are sets U and S such that T> C U , —T> C U, U C $(J7) ; all elements in S l~l A are 
singletons (have expansions of weight 1 ) and if 

{^(U) + $- w (u) + ®- w (u)) n A C S U {0}, 

then every T>-w-NAF is optimal. 

Proof of Theorem]^ Condition (jTTJ) is shown in Lemma l6.2l For the second condition, we choose 
U = $ W (V) and S = $ w (int V) \ {0}, and we show 

(^(V) + $- w (V) + <S>- W (V)) CintV. 

Optimality then follows, since each element in S D A has a weight 1 expansion by Lemma 16.31 So 
let z be an element of the left hand side of the inclusion above. Using (O and ([TU]) yields 

IHI < ||$- 1 ||i? + 2||$- 1 || u 'i?<r, 

therefore z is in the interior of V. □ 
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